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Chairman Corker, Ranking Member Cardin, esteemed members of the Committee, 


It is a privilege to speak before you today, thank you for the opportunity. 


As the self-declared Islamic State slowly but steadily loses ground in Iraq and Syria, questions 
about what lies ahead are of paramount importance. Without clairvoyance, countless factors, 
some foreseeable and some not, will influence future developments. Regarding the former, one 
can reasonably argue that: 

1) Even in the most optimistic of post-Daesh scenarios the territories previously occupied by 
the group in Iraq and Syria are highly unlikely to enjoy sociopolitical stability and 
cohesion. It is also likely that Daesh will revert to what it was in its early days, some ten 
years ago: a lethal insurgent force using tactics ranging from pure terrorism to guerrilla 
warfare. Its priorities will be to regain the territory it has lost (something it might 
occasionally be able to do in some areas) and undermine the Iraqi government and the 
various forces it is battling in Syria, by exploiting sectarian tensions. But it is also likely 
that it will still seek to plan terrorist attacks throughout and outside the region, including 
in the West. 

2) It is likely that, with time, Daesh will become a more decentralized, amorphous 
organization operating in a more asymmetric fashion around the world. This could entail 
various dynamics: 

a. Some of its leaders and cadres might relocate to bordering countries. Jordan and 
Lebanon, with their massive Syrian refugee populations and large indigenous 
Salafist scenes, are likely to experience severe problems. But arguably even more 
worrisome is the situation in Turkey, where over the last few years Daesh and 
other jihadist groups have built an extensive network with very little interference 
from Turkish authorities. It should be noted that the Turkish government’s 
crackdown after last year’s coup has led to purges within the intelligence and law 
enforcement communities that have arguably weakened the country’s 


counterterrorism capabilities. 


The West 


b. Daesh might also rely more on its affiliates worldwide. The group has established 


official provinces (wilayat) in Libya, Afghanistan, Yemen, the Sinai Peninsula, 
Nigeria, the North Caucasus, and East Asia and small groups worldwide have 
pledged allegiance to Abu Bakr al Baghdadi, the group’s leader and self- 
proclaimed caliph. Many of the regions where Daesh affiliates operate are 
ungoverned territories or, at best, rife with the conditions conducive to full-scale 
insurgencies. Clearly, varying local factors in each of these areas can drastically 
increase or reduce the chances of a regional Daesh resurgence, and the 
organization’s devotion to each region in terms of strategy, resources, and 
ideological investment varies. However, a situation where Daesh invests 
considerable support in its affiliate organizations could escalate already 
simmering conflicts in several countries around the world and the group’s ability 
to plan attacks from there. 


Many Daesh operatives might establish clandestine networks in more politically 


stable countries in the region and engage in terrorist activities with the goal of 


destabilizing them. Tunisia, like several other North African countries, is 
particularly vulnerable to this risk because of the recent and unprecedented 
Caliphate-bound mobilization of its citizens. Gulf countries might also experience 
this blowback. In addition, Russia, the Caucasus, and various Central Asian 
countries are also areas of concern, especially considering the large number of 
foreign fighters they have provided to Daesh and the prominent role they have 


played on the battlefield. 


In the context of this hearing, the threat to the West deserves a separate, more in-depth 


analysis. A critical concern for counterterrorism authorities is that Daesh members fleeing Syria 


and Iraq, particularly those holding Western passports, will travel to Europe and North America. 


While figures vary, the most reliable estimates suggest that 6,000 European and North American 


residents have joined Daesh in Iraq and Syria, with the FBI estimating 200-250 having traveled 


or attempted to travel from the United States. A significant number of these 6,000 will either a. 


die or be captured in Syria/Iraq b. be captured while trying to leave Syria/Iraq, or c. be arrested 


while entering Europe or North America. However, it is also equally clear that not all foreign 
fighters will meet any of these fates. Some will arrive in the West illegally or posing as refugees, 
as demonstrated by the path into Europe taken by some of the November 2015 Paris attackers. 
Some will return legally, often using their (real) Western passports. 

Detecting returning foreign fighters is only one of the challenges facing Western 
counterterrorism officials. An entirely different, yet no less daunting challenge, is determining 
what to do with those identified upon return. Arresting them is the immediate, easy answer. The 
reality, however, is significantly more complicated. The experience of our British allies thus far 
is instructive and exemplifies the difficulties European countries have been experiencing in 
dealing with returning foreign fighters, although with different degrees of intensity (in that 
regard, it must be said that the United States appears to be better equipped to tackle the 
challenge). Recently, in fact, the Home Office disclosed that of the 400 British foreign fighters 
who have returned from Syria/Iraq only 54 have been convicted of an offence. ! 

What is preventing authorities from arresting, prosecuting and convicting returning 
foreign fighters? It is mostly a legal matter, with lawmakers struggling to keep up with a 
constantly shifting threat environment. While legislations vary from country to country, they 
share some common problems. In some countries, joining a terrorist organization or fighting in a 
foreign conflict were not criminal offences at the time when most individuals traveled to Syria. 
Several countries have since introduced new laws which, however, cannot be retroactively 
applied. Even in countries where those behaviors have long constituted criminal offences, 
authorities experience enormous difficulties in gathering the appropriate evidence needed to 
build a strong criminal case. Having actionable intelligence may not be sufficient to meet the 
legal standard in court. 

Not all returning foreign fighters will be interested in carrying out attacks, with some 
abandoning the ideology altogether. But some will, and sorting out who poses a real threat and 
who does not will be a daunting task. Therefore, returning foreign fighters, many of whom will 
be fervent believers, battle-hardened, armed with a rolodex of dangerous contacts, and equipped 


with the know-how to carry out attacks, are understandably seen as a significant security threat. 


! Robert Mendick and Robert Verkaik, “Only one in eight jihadists returning to UK is caught and convicted,” 
Telegraph, May 21, 2016. 


And, indeed, the most lethal attack against the West in recent years, namely the November 2015 
Paris attack, was carried out by a network of returning foreign fighters dispatched by Daesh. 

Yet, an analysis of all recent jihadist-motivated attacks carried out in the West shows 
some noteworthy dynamics. A soon-to-be released report by the George Washington 
University’s Program on Extremism, the Italian Institute for International Political Studies (ISPI) 
and the ICCT The Hague examined the 51 successful attacks carried out throughout Europe and 
North America from June 2014, following the declaration of the Caliphate, until June 2017. One 
interesting finding showed that of the 65 attackers responsible for 51 attacks, only 18% were 
known to have fought with the group in Iraq or Syria. Individuals who had not traveled to Daesh- 
controlled territory, including some with no connections to the group at all, conducted most of 


the attacks. 


Types of attacks 


The analysis of the 51 attacks carried out in the last three years also shows an important 
operational pattern that could, to some degree, indicate what may lie ahead. In fact, from an 
operational perspective the attacks can be divided into three macro-categories: 

a) terrorist attacks carried out by individuals acting under direct orders from Islamic State 
leadership: 8% of attacks; 

b) terrorist attacks carried out by individuals with no connections to the Islamic State or other 
jihadist groups, but were instead inspired by their message: 26% of attacks; 

c) terrorist attacks carried out by individuals who were somehow connected to the Islamic State 
or other jihadist groups but ultimately acted independently: 66% of attacks. 


The first typology, terrorist attacks carried out by individuals acting under direct orders 


from the Islamic State’s leadership, follows a model frequently utilized by al Qaeda throughout 


the 1990s and the 2000s. Osama bin Laden’s organization selected individuals from its 
recruitment pool with characteristics which would have made them particularly suitable to carry 
out attacks in the West, trained and then dispatched them to complete their mission. After their 
departure, many planners maintained contact with the dispatched team, coordinating logistical 
matters and providing suggestions in case of unforeseen problems. Upon completion of the 


mission, al Qaeda would immediately claim responsibility, often through a so-called “martyrdom 


video” featuring the attackers explaining their motivations. The attacks of July 7, 2005 in 
London are the archetypal example of this externally directed attack approach.” 

By the second half of 2014, as it became clear that the Islamic State was involved in 
planning attacks in the West, the debate on whether the group possessed al Qaeda’s ability, 
sophistication, and patience to plan externally directed attacks raged among experts. The first 
attacks that had some connections to the group seemed to suggest it did not. They appeared to be 
the work of isolated individuals who possessed few of the skills and planning abilities of a more 
experienced terror cell. Therefore, many assumed that the group had focused all of its energy on 
the Middle Eastern front and, where the West was concerned, it was satisfied with haphazard 
attacks carried out by sympathizers. 

Many of those assumptions were proven wrong on the night of November 13, 2015, when 
an Islamic State sleeper cell conducted three separate and near-simultaneous attacks in Paris. 
Roughly four months later, on March 22nd, 2016, the remnants of the very same cell conducted a 
series of coordinated suicide bombings on the Brussels metro system and airport. Not all of the 
details regarding the Paris and Brussels attacks are known today. Yet, with time, it has become 
clear that the attacks were conceived and planned abroad by a francophone unit within the 
Islamic State’s foreign operations service, known as the Emni. The formation of this 
francophone faction within the Emni is likely the main reason why France and Belgium have 
suffered a disproportionate number of attacks, as the members of the unit have leveraged their 
own personal contacts (both online and offline) in those two countries. 

While their details are, at this stage, largely unknown, it appears that Daesh had planned 
additional complex and remotely controlled terrorist attacks in Europe (at the same time, there 
are no publicly available indications that similar operations have ever been planned in North 
America). Fortunately, these plots have all been thwarted, thanks largely to the improved levels 
of information sharing among intelligence agencies. The major question currently puzzling the 
counterterrorism community is whether the Islamic State, having suffered significant territorial 
losses and spending most of its energy on preventing more, has still maintained the ability to 


centrally plan sophisticated attacks. 


2? “Report of the Official Account of the Bombings in London on 7th July 2005.” 2006. 
http://news.bbc.co.uk/2/shared/bsp/hi/pdfs/1 1_05_06_narrative.pdf. 


In some cases, operational linkage to the Islamic State was uncovered by investigators 


months after the attack, but 26% of the attacks examined for the study appear to have been 


carried out by individuals whose connection to the Islamic State was merely ideological. In some 


cases, perpetrators belonging to this category leave messages declaring their allegiance to the 
Islamic State. Yet these individuals carry out the attacks without any form of support or even the 
knowledge of any individual linked to the Islamic State. Some of them might have at one time 
interacted, whether online or in the physical space, with members of the group. But once they 
carry out the attack, the group provides no operational support whatsoever, and the entirety of 
the planning and execution process is left to the perpetrator(s). 

Some of the attacks carried out by individuals with no operational connections have been 
difficult to categorize as motivated solely by support for the Islamic State. In some cases, while 
perpetrators’ sympathies for the Islamic State were clear, additional evidence suggests that their 
actions have been additionally motivated by: a. other ideologies, b. personal reasons, and/or c. 
psychological and psychiatric issues (note that these three factors, but often to a lesser extent, 
play a role also in the other two typologies). 

One final necessary clarification regarding many of the attacks belonging to this category 
is that they do not seem to be motivated solely by support for the Islamic State, but by jihadist 
ideology writ large. The contemporary global jihadist movement is highly fragmented, with the 
various groups often switching between cooperation and outright confrontation. In particular, the 
rivalry between the Islamic State and al Qaeda, which was borne out of the Syrian conflict, has 
created fissures that have often transcended into violence between jihadist groups worldwide. 
Yet, when it comes to most aspiring jihadists in the West, particularly those who have not 
developed operational ties to an established group, rifts are of minor significance. It is therefore 
not surprising that many attacks were carried out by individuals who declared their devotion to a 
variety of jihadist figures and groups. 

A quintessential (but hardly isolated) example of attackers’ seemingly contradictory 
allegiances is the case of Omar Mateen, the man responsible for the June 12, 2016 mass shooting 
at the Pulse nightclub in Orlando, Florida that killed 49 and wounded 53 people.* During the 
attack, Mateen pledged allegiance to Abu Bakr al-Baghdadi and the Islamic State in an 


3 Steve Visser, “Orlando Killer Repeatedly Referenced ISIS,” CNN, September 24, 2016. 


emergency call, and later Daesh media outlets claimed responsibility for the attack.t However, 
Mateen’s loyalties were indicative of the “choosing and fusing” of ideologies often demonstrated 
by attackers without tangible connections to any group." Mateen, despite his final pledge of 
allegiance, had previously expressed support for Daesh and Jabhat al-Nusra on social media, and 
also claimed to be a member of Hizbullah. While changes in affiliation between Daesh and al- 
Nusra, two groups with generally similar ideologies but different strategies and leadership 
disputes are more common amongst Western jihadists, the Hizbullah claims put Mateen on both 
sides of the Sunni-Shi’a divide. 

Like many other Western jihadists, Mateen was attracted to the broader jihadist ideology 
more than to a specific group. From a counterterrorism perspective, understanding, and 
eventually exploiting, the complex dynamics within the global jihadist movement is of 
paramount importance. However, those leadership fissures should not be overemphasized when 
it comes to the grassroots level, particularly in the West. Most aspiring jihadists simply want to 
fight jihad and regard squabbles between jihadist leaders as distant, confusing, annoying, and 
counterproductive. In many cases, they join or sympathize with a jihadist group not because they 
have a clear preference for one over the others, but rather because of chance encounters and 
logistical circumstances. Group affiliation is in most cases less important than identification, 
albeit to varying degrees, with the central tenets of Salafi-jihadist ideology.’ 


The majority (66%) of the attacks seen throughout the West over the last three years fall 


within a hybrid category, not externally directed but also not completely independent. Dynamics 


are at this stage difficult to assess, given the lack of detailed information on many cases. 
However, several attacks appear to be crowd sourced, meaning they are carried out by 
individuals who possess some degree of operational connectivity to the Islamic State, but act 
with almost complete autonomy when carrying out the attack. This dynamic allows the Islamic 
State to obtain a high return in terms of publicity despite the low investment in resources. By the 


same token, perpetrators who associate themselves to the Islamic State amplify the propaganda 


4 Ibid. 

5 Paige Pascarelli, “Ideology A La Carte: Why Lone Actor Terrorists Choose and Fuse Ideologies.” Lawfare, 
October 2, 2016. 

€ Adam Taylor, “Omar Mateen May Not Have Understood the Difference between ISIS, Al-Qaeda and Hezbollah.” 
Washington Post. June 13, 2016. 

7 Sarah Gilkes, Not Just the Caliphate: Non—Islamic State—Related Jihadist Terrorism in America, GW Program on 
Extremism. 2016. 


value of their actions and boost their chances of being glorified within the global jihadist 
community. 

Mounting evidence suggests that this hybrid dynamic has been further bolstered by the 
growth of the phenomenon of “virtual entrepreneurs”. The Islamic State’s virtual planners are 
individuals who, using social media and encrypted online messaging platforms, connect with 
would-be attackers in countries outside of Islamic State-held territory and guide them through 
the planning and execution of terrorist attacks.® By directing attacks from abroad, the Islamic 
State drastically expands its reach and its ability to manage and plan attacks overseas.” 

The Islamic State’s virtual entrepreneurs are usually located in the territory the group 
holds, are skilled in the use of cyber resources, and have ties to the leadership of the 
organization. They are divided by nationality and language skills, and are tasked with identifying 
and grooming potential attackers who speak the same language online. The identification process 
for attackers includes virtual planners finding vocal supporters of the Islamic State on social 
media platforms such as Facebook and Twitter, initiating contact and conversation with them via 
encrypted messaging platforms like Telegram, SureSpot, Kik, and Whatsapp, and instilling them 
with the operational knowledge necessary to begin planning an attack.'° Individuals like Rachid 
Kassim and Junaid Hussain in the French and English speaking scene respectively are perfect 


examples of virtual planners. 


Future scenarios and recommendations 


As seen, a hypothetical demise of the Caliphate is not likely to mean that Daesh will 
disappear. Some members of the group will stay in Syria and Iraq and continue to fight. Others 
will export their violence to other areas, from ungoverned territories to urban centers, in other 
parts of the Middle East and North Africa, and the West. 

The Daesh brand and the emotional appeal of its declared Caliphate are also unlikely to 
vanish any time soon. The existence of a territorial entity with a self-declared religious 


significance made Daesh the world’s most notorious jihadist group, somewhat eclipsing al 


8 Alexander Meleagrou-Hitchens and Seamus Hughes, “The Threat to the United States from the Islamic State’s 
Virtual Entrepreneurs.” CTC Sentinel 10 (3), 2017. 

° Daveed Gartenstein-Ross and Madeleine Blackman, “ISIL’s Virtual Planners: A Critical Terrorist Innovation.” 
War on the Rocks. January 4, 2017.h 

10 Meleagrou-Hitchens and Hughes, “The Threat to the United States from the Islamic State’s Virtual 
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Qaeda, and simultaneously allowed the group to establish a global network and plan operations 
worldwide. Although the loss of territory may undermine the legitimacy of the organization to 
some extent, the so-called virtual Caliphate ensures a future for Daesh. Despite critical 
challenges, their digital efforts may rekindle commitment and support for the group’s cause 
among sympathizers worldwide and prompt some to carry out terrorist attacks in its name. 

It should also be noted that various indications also point towards a resurgent al Qaeda. 
Despite its uneasy relationship with al Qaeda Central, Jabhat Fateh al Sham (previously known 
as Jabhat al Nusra), has quietly but surely carved out a de-facto mini-state in parts of Syria. 
Furthermore, al Qaeda in the Arabian Peninsula (AQAP) has been experiencing ups and downs 
during the ongoing Yemen war, and while it no longer controls a sizeable region (as it did at 
some point), it is still a vibrant branch of the global organization actively planning attacks 
against the West. There are also rumors of a revamped leadership structure within al Qaeda 
Central. While all these dynamics need to be carefully assessed, it would be erroneous to treat al 
Qaeda as obsolete. 

The counterterrorism community is currently debating what the relationship between a 
declining Daesh and a seemingly resurgent al Qaeda is and will be. Over the last few years the 
competition between the two groups has played out on a global scale. It is not currently clear 
whether these dynamics will continue or whether, as some have argued, the two groups, having a 
common history, ideology and aims, will reconcile their differences, work together, and even 
merge. It is also likely that these dynamics might play out in different ways in different places. 
Understanding and eventually exploiting the complex and ever-fluctuating chasms within the 
global jihadist movement is crucial. 

What is clear though is that what we have faced, are facing and will be facing in the 
future is not a group or a collection groups, but, rather, an ideological movement, namely the 
global jihadist movement. This movement is not homogenous but, rather, plagued by divisions 
and rivalries. Ultimately however, it has a clear vision and is guided by a strong doctrine. Daesh 
is just the latest and arguably most successful incarnation of this movement. Daesh’s vicissitudes 
are hugely important in shaping the future of this movement. But even its hypothetical demise is 
unlikely to cause the end of the global jihadist movement. 

It is exactly because of the paramount importance of the ideological component, that in 


briefly providing my recommendations on how to better prevent terrorist attacks worldwide and 


in the United States, I will begin with the centrality of tackling the ideology that motivates 
Daesh, al Qaeda, their affiliates, and unaffiliated jihadis worldwide. Over the last few years we 
have been somewhat timid in fighting this admittedly daunting battle. I do see encouraging signs 
from the Middle East, where various countries (even some that previously had not recognized the 
problem or even contributed to its expansion) have engaged in a full-fledged ideological battle 
against not just Daesh and jihadist ideology, but the broader Islamist ideology as well. Likely, 
these efforts will not bear fruit for a number of years as the jihadist ideology has been sustained 
for and solidified by countless socioeconomic, religious, and political factors. And while this 
complex battle has multiple, overlapping layers, it is noteworthy that most Middle Eastern 
countries recognize that religious engagement is one of its key aspects. 
At the tactical level, more immediate results can be achieved through a combination of 
international and local efforts. Of the many, let me emphasize four: 
e Prevent foreign fighters from leaving Syria/Iraq. This goal could be better achieved 
through aggressive military tactics that prevent Daesh fighters from fleeing the 
battlefields and from sealing Syria and Iraq’s external borders. Turkey’s role in these 


efforts is crucial. 


e Improve information sharing among intelligence and law enforcement agencies 
(internationally but also domestically within each country). In an ideal world, the goal 
would be the creation of a global database of foreign fighters and their milieus which 
countries would update in real time. However, in reality, countless factors, including 
political rivalries and bureaucratic sluggishness make information sharing, even among 
close allies, very challenging. 


e Increase resources for law enforcement and intelligence agencies. From the Paris attacks 


to, more recently, the London Bridge van ramming, from the San Bernardino shooting to 
the Manchester suicide bombing, the vast majority of terrorist attacks carried out in the 
West over the last three years were perpetrated by individuals who were known to 
authorities. In most cases these individuals had appeared on the authorities’ radar only 
peripherally and were not of high priority. One of the main reasons why officials cannot 
conduct further investigations and surveillance on known extremists who have not yet 
crossed the threshold of criminally relevant behavior is the limited resources they possess 


in order to keep tabs on a burgeoning number of jihadist sympathizers. An increase in 


resources will not constitute a silver bullet but will allow authorities to expand the 


number of known extremists it can monitor. 


e Implement Countering Violent Extremism (CVE) initiatives. As it is now almost 


universally accepted throughout the counterterrorism community, repressive methods 
alone are unlikely to defeat terrorism. Whether they entail counter-messaging campaigns, 
grassroots activities or tailored interventions aimed at de-radicalizing specific individuals 
(an especially important endeavor when trying to tackle the issue of returning foreign 
fighters), CVE activities are a necessary complement to traditional counterterrorism 
work. They are hardly infallible and indeed many need to be perfected (and some, to be 
honest, completely scrapped). CVE programs will not always work perfectly, and 
realistically, the goal of CVE should be threat reduction, not threat elimination. However, 
it has also become increasingly clear that CVE needs to be part of any comprehensive 


counterterrorism strategy. 


Chairman Corker, Ranking Member Cardin, esteemed members of the Committee, these are just 
some initial thoughts on this very important and complex matter. I thank you again for this 


opportunity and look forward to your questions. 


Dr. Lorenzo Vidino is the director of the Program on Extremism at the George Washington 


University. He is also the director of the terrorism program at ISPI (Milan, Italy). 


